General
-
Target
stage_4_remcos.bin
-
Size
469KB
-
MD5
ba07eb52ad32844e2a34c9a30e92d4f9
-
SHA1
e87c52e3fd76d2120f671c8f3163255fbeec564f
-
SHA256
4c565f789e34d0cf9d6cb7361ad45a5a2ffa01f664dcd49a1da2e25be36f5682
-
SHA512
b5cbf9f7cb4232445292d56e7be820c7046090c3a0b7a677369ab1f3b972238db47b94218cd25be4280f658306ab13c617b91b9c53d805c4bb1d3f54e609083c
-
SSDEEP
12288:Omnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSqn9:2iLJbpI7I2WhQqZ7q9
Malware Config
Extracted
remcos
RemoteHost Ewa Cartoon
164.68.105.38:1960
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-C9NN2D
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource stage_4_remcos.bin
Files
-
stage_4_remcos.bin.exe windows x86
5d354883fe6f15fcf48045037a99fb7a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CopyFileW
CreateMutexA
GetLocaleInfoA
CreateToolhelp32Snapshot
OpenMutexA
Process32NextW
Process32FirstW
VirtualProtect
SetLastError
VirtualFree
VirtualAlloc
GetNativeSystemInfo
HeapAlloc
GetProcessHeap
FreeLibrary
IsBadReadPtr
GetTempPathW
OpenProcess
lstrcatW
GetCurrentProcessId
GetTempFileNameW
GetCurrentProcess
GetSystemDirectoryA
GlobalAlloc
GlobalLock
GetTickCount
GlobalUnlock
WriteProcessMemory
ResumeThread
GetThreadContext
ReadProcessMemory
CreateProcessW
SetThreadContext
LocalAlloc
GlobalFree
MulDiv
SizeofResource
SetFilePointer
FindResourceA
LockResource
LoadResource
LocalFree
FormatMessageA
AllocConsole
GetModuleFileNameA
lstrcpynA
QueryPerformanceFrequency
GetLongPathNameW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapSize
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExA
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
HeapReAlloc
GetACP
GetStdHandle
GetModuleHandleExW
MoveFileExW
RtlUnwind
RaiseException
LoadLibraryExW
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
ExpandEnvironmentStringsA
FindNextFileA
FindFirstFileA
GetFileSize
TerminateThread
GetLastError
SetFileAttributesW
GetModuleHandleA
RemoveDirectoryW
MoveFileW
CreateDirectoryW
SetFilePointerEx
GetLogicalDriveStringsA
DeleteFileW
DeleteFileA
GetFileAttributesW
FindClose
lstrlenA
GetDriveTypeA
FindNextFileW
GetFileSizeEx
FindFirstFileW
ExitProcess
GetProcAddress
LoadLibraryA
CreateProcessA
PeekNamedPipe
CreatePipe
TerminateProcess
ReadFile
HeapFree
HeapCreate
CreateEventA
GetLocalTime
CreateThread
SetEvent
CreateEventW
WaitForSingleObject
Sleep
GetModuleFileNameW
CloseHandle
ExitThread
CreateFileW
WriteFile
QueryPerformanceCounter
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
DecodePointer
EncodePointer
WideCharToMultiByte
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
WaitForSingleObjectEx
ResetEvent
SetEndOfFile
user32
CallNextHookEx
GetKeyboardLayoutNameA
GetKeyState
GetWindowTextLengthW
GetWindowThreadProcessId
SetForegroundWindow
SetClipboardData
EnumWindows
ExitWindowsEx
TranslateMessage
DispatchMessageA
GetMessageA
GetWindowTextW
wsprintfW
GetClipboardData
UnhookWindowsHookEx
GetForegroundWindow
ToUnicodeEx
GetKeyboardLayout
SetWindowsHookExA
CloseClipboard
OpenClipboard
GetKeyboardState
DrawIcon
GetSystemMetrics
GetIconInfo
SystemParametersInfoW
GetCursorPos
RegisterClassExA
AppendMenuA
mouse_event
CreateWindowExA
DefWindowProcA
TrackPopupMenu
CreatePopupMenu
EnumDisplaySettingsW
SendInput
CloseWindow
EmptyClipboard
ShowWindow
SetWindowTextW
MessageBoxW
IsWindowVisible
gdi32
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
StretchBlt
GetDIBits
DeleteDC
DeleteObject
CreateDCA
GetObjectA
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetUserNameW
RegEnumKeyExA
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
OpenSCManagerA
ControlService
StartServiceW
QueryServiceConfigW
ChangeServiceConfigW
OpenServiceW
EnumServicesStatusW
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCreateKeyA
RegCloseKey
RegQueryInfoKeyW
RegQueryValueExA
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegSetValueExA
RegOpenKeyExA
RegOpenKeyExW
RegCreateKeyW
RegDeleteValueW
RegEnumValueW
RegQueryValueExW
RegDeleteKeyA
shell32
ShellExecuteExA
Shell_NotifyIconA
ExtractIconA
ShellExecuteW
shlwapi
StrToIntA
PathFileExistsW
PathFileExistsA
winmm
waveInPrepareHeader
waveInStop
waveInUnprepareHeader
mciSendStringA
PlaySoundW
waveInOpen
waveInStart
waveInAddBuffer
waveInClose
mciSendStringW
ws2_32
WSAGetLastError
recv
connect
socket
send
WSAStartup
closesocket
inet_ntoa
gethostbyname
WSASetLastError
inet_addr
gethostbyaddr
getservbyport
ntohs
getservbyname
htons
htonl
urlmon
URLDownloadToFileW
URLOpenBlockingStreamW
gdiplus
GdiplusStartup
GdipGetImageEncoders
GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipFree
GdipGetImageEncodersSize
GdipSaveImageToStream
GdipLoadImageFromStream
wininet
InternetOpenUrlW
InternetCloseHandle
InternetReadFile
InternetOpenW
Sections
.text Size: 337KB - Virtual size: 336KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 1024B - Virtual size: 560B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ